Real world data: new horizons for data processing in healthcare

Real World Data (RWD) are becoming one of the most crucial issues in the Italian health sector. There is no doubt that the current digitisation of health services, expected to expand even more with the PNRR (Recovery and Resilience Plan) will lead to a significant production of digital data in healthcare.

Such data originates from patient care, but apart from being used in clinical settings and/or for the improvement of drugs and devices, it can also play a key role in system governance.

This is why the Note 'Observational research: a pillar in the knowledge production process' published by the Italian National Coordination Centre of Ethical Committees (CCNCE), set up at AIFA, the Italian Medicines Agency, deserves in-depth analysis.

How the Note was created

The CCNCE Note originates under Decree 30 November 2021 - Measures to facilitate and support the conduct of non-profit clinical trials of medicinal products and observational studies and to regulate the transfer of data and results of non-profit trials for registration purposes, pursuant to Article 1, para. 1, letter c) of Leg. Decree 14 May 2019, no. 52: what people in the field call more concisely, "Decreto cessione dati” (Data Transfer Decree).

This Decree, in addition to establishing how data collected within the scope of a non-profit clinical trial can be transferred, also paves the way for a redefinition and rethinking of the complex field of so-called 'observational studies' in the light of the new EU framework as defined by EU Reg. 2014/536.

More precisely, the Decree (implementing Art. 6 para. 6-ter of Legislative Decree 200/2007 as amended by Leg. Decree 52/2019) states that:

• ‘observational studies’ means “studies referred to in Article 2, paragraph 2, point 4 of EU Reg. 2014/536, the subject of the protocol being the study of drugs in the normal clinical practice in accordance with the authorised indications. Observational studies may be either non-profit or for-profit” – Article 1(4)(c) of Decree 30 November 2021
• the new guidelines for the classification and carrying out of observational studies on drugs are defined by AIFA.

Moreover, the CCNCE Note introduces considerations and indications regarding a particular and more specific 'category' of observational studies: those in which the health professional (researcher) merely records what is happening in actual reality. So it reads:

"This paper is concerned with observational studies understood as studies characterised by the absence of active intervention on the part of the researchers, thus defined here as studies in which the researcher does not determine the assignment of subjects to the different study groups, but merely records (observes) what happens in reality".

Basically, in these studies there is no clinical protocol with an end point, but merely the observation, collection and recording of data emerging from everyday reality.

The term Real World Data is not directly used, but that is the meaning that the wording points to. In fact, on the Digital Health Europe website, RWD are defined as follows:

“Real world data is big data, referring specifically to any type of data not collected in a randomised clinical trial. This data can complement randomised clinical trial data to fill the knowledge gap between clinical trials and clinical practice, provide new insights into disease patterns and help improve the safety and effectiveness of health interventions (EU definition)”.

What the Note states

Having clarified the scope of application, let us see what the Note states, particularly in relation to data processing.

The National Coordination Centre recommends first and foremost that the Ethics Committees adopt an attitude of maximum simplification of obligations related to data protection "...by removing or reducing as much as possible the formal obstacles that an interpretation of the legislation, based on a predominantly 'interventionist' and 'single-use' approach, still poses to the use and re-use of research data".

Data re-use is not prohibited

In essence, the direction is to simplify and realise that the reuse of data is not prohibited. It is here that the first great opening, also from a cultural point of view, can be found.

In fact, it is well known that Article 6(4) GDPR expressly admits the possibility of re-using data for a purpose other than that for which the data were collected, provided that the use is assessed as 'compatible' with the original purpose. Article 5(b) also establishes, in particular, a sort of presumption of non-incompatibility for a secondary use for scientific research purposes.

It is equally known that in Italy this legal opening introduced by the GDPR is severely limited by Article 110-bis of the Privacy Code, which binds data re-use to an authorisation by the Data Protection Authority, which may be specific or have a general nature (Article 110-bis(3)).

Now, apart from the fact that an authorisation regime seems to defeat the underlying philosophy and logic of the GDPR, which is based on the principle of accountability, there is some interpretative confusion because it is not clear (and is being debated among insiders) whether Measure No. 101 of 10 August 2018 issued by the Italian DPA on the processing of special categories of data (especially the part concerning Scientific Research) can be considered a general provision legitimising the re-use of data pursuant to Article 110-bis. This is in view of the fact that it represents the evolution of the previous Authorisation 9/2016, which is certainly general in scope, which implements Article 21 Leg. Decree 101/2018 and which is published in the Official Gazette. Our personal opinion is that it can be considered a general authorisation, but we are not aware of any position of the DPA to that effect and therefore public facilities are all very reluctant in this regard.

In this respect, the Note, while certainly not overriding the legislative text outright, does however strongly urge the legislator to revise the entire matter in a much less restrictive sense, also highlighting the importance of data re-use for the country and pushing for an interpretation that favours such re-use.

Legitimate interest as a legal basis

The second major opening of the Note concerns the legal basis: it is stated that data re-use can also have its legal basis in legitimate interest (Art. 6(1)(f) GDPR). The legal reasoning supporting this is very interesting:

"as a 'source' of significant knowledge for the scientific community, such data must be able to circulate as freely as possible within it. Particularly when the purposes of the research are observational (in the sense considered here), it should be possible to use alternative legal bases to facilitate the (re)processing of the data, without having to rely each time on a new consent of the data subject. The only limitation would be a prior and appropriate pseudonymisation/encryption of the patient's identity, thus reasonably and effectively balancing the "right of the individual and the interest of the general public" (Article 32 of the Italian Constitution).

Also: “from this point of view, a reference to legitimate interest as a possible legal basis for processing could, within the limits seen above, benefit the advancement of observational research”.

Here that sort of implicit obligation to use consent as a legal basis always and in all cases is challenged, probably for the first time by an institutional body of this level, paving the way for other legal bases (moreover, it is highly debatable whether consent can be considered truly 'free' for this type of processing).

On legitimate interest, there is one final point to be made.

This legal basis (in combination with one of the exceptions in Art. 9) may in some respects simplify the procedure with respect to consent, but it still requires other (and higher) levels of caution. It can in fact be lawfully used only after a so-called balancing of interests has been carried out.

On this subject, the judgment of the Court of Justice (Second Chamber) of 4 May 2017 - C-13/16 established a three-step test:

• the existence of an interest on the part of the data controller must be established,
• the processing of that data must be necessary in order to serve that interest;
• the interest of the data controller must prevail over that of the data subject (balancing of interests). Thus, processing cannot be justified (lawful) if it entails detrimental effects on the rights and freedoms or legitimate interests of the individual.

Each stage consists of a separate assessment from the others.

Why this Note is so important

This note is so significant because it was issued by the national coordinating body of the Ethics Committees: it is clear that the Committees can decide independently, but it is equally true that this is a very strong input.

The scope is clear if one looks at the path that Europe has taken with the European Data Strategy and, in particular, in the architecture of the Proposal of regulation of the European Parliament and of the Council on the European Health Data Space.

In this context, the value of real-world data is indisputably revealed in the recent EU document Study on the use of real-world data (RWD) for research, clinical care, regulatory decision-making, health technology assessment, and policymaking (2021).

It is precisely because of this value and scope that we cannot lag behind.